Optave generally requires its Sub-processors to sign a Data Processing Agreement (“DPA”) that is at least equivalent to the obligations as those required from Optave (as a Data Processor), including but not limited to the requirements to:

• Process Personal Data in accordance with data controller’s (i.e., Client’s) documented instructions (as communicated in writing to the relevant Sub-processor by Optave);
• In connection with their sub-processing activities, use only personnel who are reliable and subject to a contractually binding obligation to observe data privacy and security, to the extent applicable, pursuant to applicable data protection laws;
• Provide regular training in security and data protection to personnel to whom they grant access to Personal Data;
• Implement and maintain appropriate technical and organizational measures (including measures consistent with those to which Optave is contractually committed to adhere insofar as they are equally relevant to the Sub-processor’s Processing of Personal Data on Optave’s behalf) and provide an annual certification that evidences compliance with this obligation. In the absence of such certification Optave reserves the right to audit the Sub-processor;
• Promptly inform Optave about any actual or potential security breach; 
• Cooperate with Optave in order to deal with requests from data controllers, data subjects or data protection authorities, as applicable

This policy does not give Optave’s Clients any additional rights or remedies and should not be construed as a binding agreement. The information herein is only provided to illustrate Optave’s engagement process for Sub-processors as well as to provide the actual list of third-party Sub-processors and content delivery networks used by Optave as of the date of this policy (which Optave may use in the delivery and support of its Services).